cache test image results

[turadg]

Problem to be solved

We now have caching of build layers (#2) so that the build step takes just seconds if nothign has changed. (e.g. push to main)

But the tests still takes tens of minutes to run. Some of that time is (in ascending duration):

• building the test stage on top of the use stage
• transferring the full image from the remote builder to the action runner
• running the entrypoint of the test image to verify all checks pass

When the image has the same sha as a previously tested image, there's no need to do the last two steps.

Description of design

First, use caching in the action runner (perhaps https://github.com/actions/cache) to check whether a particular test image (by sha) has already been run. If it has, trust that earlier run's status.

That will shave off most of the time. A further optimization is to get the sha before loading the image, and only loading if it needs to run locally.

It may be tempting to make a "verified" image that's like test but has the test as a RUN instead of ENTRYPOINT. One downside to that is we pay for build minutes, but not test minutes. Another is that conceptually, there's no need to tag and maintain such an image because it's internal state doesn't matter.